Although it is applicable, in principle, to any network, the present invention and the objects of the present invention shall be described below with reference to motor vehicle controllers connected to one another via the CAN (Controller Area Network) system. Details about the CAN system are described in a publication by Etschberger, "Controller Area Network", Hansa Verlag, 1994.
The processors used in such controllers, for example, engine controllers, pump controllers, brake controllers, etc., are normally supplied with an external clock signal supplied by an oscillator in the form of an oscillating quartz crystal. The accuracy with which the clock frequency of the oscillator is set directly affects the computing accuracy of the respective processor.
If interference occurs in this external oscillator or if the external oscillator fails completely, the function of the respective controller can be impaired or fully disabled. If such a failure occurs in important vehicle controllers, such as the engine controller, this normally results in an extremely undesirable breakdown of the vehicle.
Since the probability of a failure of an oscillator during its expected lifetime is not negligible, appropriate safety measures must be taken to prevent such failures.
According to one of the objects of the present invention, an additional, redundant oscillator (backup oscillator) is provided.
However, it is extremely expensive to provide two identical oscillators of the same accuracy for each controller. Therefore, it is possible to provide an additional simplified backup oscillator in the processor of the controller. However, due to the simplified design of the backup oscillator, the clock frequency provided by the same may vary in broad limits, which may amount to up to .+-.50%.
It is possible to test this simplified backup oscillator during manufacturing and adjust the clock signal according to the test result.
This procedure, however, is both costly and insufficient in practice, since it does not take into account a possible change in the ambient conditions, e.g., in the operating temperature. Therefore, with this procedure at least appropriate compensation for the temperature variation of the backup oscillator is needed, which further increases the costs involved.